Help, `npm audit` says I have a vulnerability in react-scripts!
### `npm audit` is broken for front-end tooling by design Bad news, but it's true. See [here](https://overreacted.io/npm-audit-broken-by-design/) for a longer explanation. ### If you think you found a real vulnerability in `react-scripts` If you **know** that it affects CRA users because you **understand** what the vulnerability is, report it [here](https://github.com/facebook/create-react-app/blob/master/SECURITY.md) as soon as possible. If you're **not sure** but your CI is failing or you're worried about what `npm audit` tells you, keep reading. **Do not** file new issues based on `npm audit` if you don't 100% understand the problem. They will be closed (see why below). If you really need to discuss it, reply in this thread instead. ### `npm audit` says there's a warning about vulnerabilities in my project Open `package.json`. You will find this: ```js "dependencies": { "react": "^17.0.2", "react-dom": "^17.0.2", "react-scripts": "4.0.3" } ``` Take `react-scripts` and **move it to `devDependencies`** (if you don't have it, create it): ```js "dependencies": { "react": "^17.0.2", "react-dom": "^17.0.2" }, "devDependencies": { "react-scripts": "4.0.3" }, ``` Then, **ensure you run `npm audit --production` rather than `npm audit.`** This will fix your warnings. ### But isn't this just ignoring the problem? No. Create React App is a **build tool**. In other words, it doesn't produce a running Node application. It runs at the b
Posted by gaearon on Jul 2, 2021, 4:54 PM
Tags
Related issues
- Many devs love to shit on the guy from the 'I just want the exe.
- Now imagine how poor people stress if their smartphone bricks or gets damaged or lost.
- Resuming an extended-thinking session fails permanently with 400 "thinking blocks cannot be modified" (transcript stores thinking text as empty but keeps signat
- I'll preface this with a statement that as a European I want European alternatives to succeed, and MS-owned GitHub to shrivel and disappear.
- Yeah, but there’s a world of difference between “not perfect” and “we rounded a few sliders, and now the modal is a nightmare to use”.
- I used to write a lot of native Windows corporate software in the 90's and 2000's and my standard login window was a floating draggable o...
Raise real-world problems, find people facing the same issue, and discuss solutions.3,000 issues0 comments
reliability (SaaS)
Many devs love to shit on the guy from the 'I just want the exe.
Now imagine how poor people stress if their smartphone bricks or gets damaged or lost.
Resuming an extended-thinking session fails permanently with 400 "thinking blocks cannot be modified" (transcript stores thinking text as empty but keeps signat
I'll preface this with a statement that as a European I want European alternatives to succeed, and MS-owned GitHub to shrivel and disappear.
Yeah, but there’s a world of difference between “not perfect” and “we rounded a few sliders, and now the modal is a nightmare to use”.
I used to write a lot of native Windows corporate software in the 90's and 2000's and my standard login window was a floating draggable o...
App broken with Mosquitto broker 7.0.0
[BUG] Remote Control: automatic reconnection doesn't work -- connection drops silently with no recovery
Help, `npm audit` says I have a vulnerability in react-scripts!
### `npm audit` is broken for front-end tooling by design Bad news, but it's true. See [here](https://overreacted.io/npm-audit-broken-by-design/) for a longer explanation. ### If you think you found a real vulnerability in `react-scripts` If you **know** that it affects CRA users because you **understand** what the vulnerability is, report it [here](https://github.com/facebook/create-react-app/blob/master/SECURITY.md) as soon as possible. If you're **not sure** but your CI is failing or you're worried about what `npm audit` tells you, keep reading. **Do not** file new issues based on `npm audit` if you don't 100% understand the problem. They will be closed (see why below). If you really need to discuss it, reply in this thread instead. ### `npm audit` says there's a warning about vulnerabilities in my project Open `package.json`. You will find this: ```js "dependencies": { "react": "^17.0.2", "react-dom": "^17.0.2", "react-scripts": "4.0.3" } ``` Take `react-scripts` and **move it to `devDependencies`** (if you don't have it, create it): ```js "dependencies": { "react": "^17.0.2", "react-dom": "^17.0.2" }, "devDependencies": { "react-scripts": "4.0.3" }, ``` Then, **ensure you run `npm audit --production` rather than `npm audit.`** This will fix your warnings. ### But isn't this just ignoring the problem? No. Create React App is a **build tool**. In other words, it doesn't produce a running Node application. It runs at the b
Comments (0)
No comments yet. Start the discussion.